Unroll.me Service Faces Backlash Over a Widespread Practice: Selling User Data

For months, Uber has paid a public price for some of the questionable tactics it has used to conquer the transportation industry. Now another company is experiencing some of the fallout for working with Uber.Slice Intelligence, a data firm that uses an email management program called Unroll.me to scan people’s inboxes for information, faced an outcry that began on Sunday after The New York Times reported that Uber had used Slice’s data to keep tabs on its ride-hailing rival Lyft.Unroll.me, a free service to unsubscribe from email lists, can scour people’s inboxes for receipts from services like Lyft and then sell the information to companies like Uber. The data is anonymized, meaning individuals’ names are not attached to the information, and can be used as a proxy for the health of a rival.After the revelation, angry users demanded that Unroll.me explain why the company had gone into their inboxes and betrayed their trust. Late on Sunday, Jojo Hedaya, the chief executive of Unroll.me, apologized in response to the surprised reaction to a practice that he said the company had been open about in the past.“It was heartbreaking to see that some of our users were upset,” Mr. Hedaya said in a blog post. “Recent customer feedback tells me we weren’t explicit enough.”What Unroll.me does is far from an anomaly — it is part of an expansive and largely unregulated world of selling personal data collected by online consumer services. As long as a service like Unroll.me has a privacy policy, adheres to it and does not sell personally identifiable information, like someone’s name, it is fairly free to package and sell the data it collects.Yet privacy advocates said the modern technology of data analytics allowed such fine-grained measurement of a person’s online behavior that the concept of personally identifiable information was all but obsolete.“Many of the services or apps we use for ‘free’ are monetizing data about us,” said Lee Tien, a lawyer at the Electronic Frontier Foundation, an organization focused on digital rights.Companies like Unroll.me have long acted as intelligence services offering insights to businesses seeking to gain a competitive edge. Both Uber and Lyft pay for information from Slice as well as other data services, according to two people familiar with the companies’ competitive intelligence programs, who asked to remain anonymous because the programs were confidential. Uber and Lyft declined to comment.Unroll.me, which was bought by Slice in 2014, is a tiny player in the personal data market. The larger data brokers — with names like Acxiom, CoreLogic, Datalogix and ID Analytics — have been the subject of inquiries by a congressional committee and the Federal Trade Commission.In 2014, after concluding its investigation, the F.T.C. called on Congress to protect consumers against the unchecked collection and marketing of their digital data. The F.T.C. report detailed how some of the companies classify consumers in data-driven social and demographic groups for marketing purposes with labels like “financially challenged,” “diabetes interest” and “smoker in the household.” The concern is that such classifications could be used to limit fair access to financial services or health insurance.The F.T.C. recommendation, which was endorsed in a separate report by the Obama administration, was not taken up in Congress.Unroll.me bills itself as offering an easy way to “clean up your inbox.” After someone grants the service access to his or her email account, Unroll.me serves up a list of all the subscriptions they are a part of, with the option to quickly opt out of the ones they no longer want to receive. The company also organizes subscription emails and delivers a newsletter-style digest of some subscriptions.The service, which began as a test in 2011, quickly took off with users, attracting the attention of Rakuten, the Japanese e-commerce giant that now owns Slice. Rakuten invested in Unroll.me before Slice ultimately bought it.Unroll.me discloses its freewheeling use of personal data in its privacy policy, which says that “we may collect, use, transfer, sell and disclose nonpersonal information for any purpose” and that the data can be used “to build anonymous market research products and services.”Yet few people read such policies closely, privacy advocates said. Katharina Kopp, director of policy at the Center for Digital Democracy, said of Unroll.me, “Under the disguise of being customer friendly and helping their customers to get rid of ‘email junk,’ they allow the profiling and targeting of their unwitting customers by third parties.”Ms. Kopp called the Unroll.me tactic a “particularly misleading practice,” despite the disclosure in its privacy policy.In its blog post on Sunday, Unroll.me said it had underestimated how many people would be surprised at the methods it used to build its business. The company said it was working on making its business model more transparent to users, with clearer messaging on its website, on its app and in its frequently asked questions section.In several posts on Twitter, Unroll.me pointed fingers at Google’s Gmail and at Facebook as having more personal data on people. “Just know, Gmail has more data on you than we ever would,” Unroll.me posted.Some of those who were upset with the practices of Unroll.me chalked it up to a learning experience.“If it is on the internet and is free, then you are not the client or the user,” wrote Craig, a commenter on the Unroll.me blog post. “You are the product.”